CVE-2026-35312: Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Server)

Synopsis

A critical unauthenticated remote compromise vulnerability exists in Oracle Virtual Directory (component: Virtual Directory Server), affecting versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware. An attacker with network access can exploit this flaw over LDAP without any credentials or user interaction. Successful exploitation results in full takeover of the Oracle Virtual Directory service, giving the attacker read, write, and denial-of-service capability over the directory. No fix versions have been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Virtual Directory service over the network via LDAP; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup to succeed.

Blast Radius

• Reads all directory data stored in Oracle Virtual Directory, including user credentials, group memberships, and any LDAP-backed application data.
• Modifies or deletes directory entries, enabling privilege escalation in downstream systems that trust the directory for authentication and authorization.
• Crashes or fully disrupts the Virtual Directory Server process, denying LDAP-dependent applications and users access to directory services.
• Full service takeover allows the attacker to pivot the compromised directory server as a foothold into adjacent identity-dependent infrastructure.